Skip to content

Commit 68c6a1c

Browse files
raffaelespazzoliraffaelespazzoli
authored
Merge pull request #245 from lhind-tia-cop/azure-secret-engine-role
add(): add CRD for AzureSecretEngineRole
2 parents 19ed719 + 0da929e commit 68c6a1c

18 files changed

+1015
-6
lines changed

‎PROJECT‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -421,6 +421,19 @@ resources:
421421
kind: GCPAuthEngineRole
422422
path: github.com/redhat-cop/vault-config-operator/api/v1alpha1
423423
version: v1alpha1
424+
webhooks:
425+
defaulting: true
426+
validation: true
427+
webhookVersion: v1
428+
- api:
429+
crdVersion: v1
430+
namespaced: true
431+
controller: true
432+
domain: redhat.io
433+
group: redhatcop
434+
kind: AzureSecretEngineRole
435+
path: github.com/redhat-cop/vault-config-operator/api/v1alpha1
436+
version: v1alpha1
424437
webhooks:
425438
defaulting: true
426439
validation: true

‎api/v1alpha1/azuresecretenginerole_types.go‎

Lines changed: 209 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,209 @@
1+
/*
2+
Copyright 2021.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package v1alpha1
18+
19+
import (
20+
"context"
21+
"reflect"
22+
23+
vaultutils "github.com/redhat-cop/vault-config-operator/api/v1alpha1/utils"
24+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
25+
"sigs.k8s.io/controller-runtime/pkg/client"
26+
)
27+
28+
// AzureSecretEngineRoleSpec defines the desired state of AzureSecretEngineRole
29+
type AzureSecretEngineRoleSpec struct {
30+
// Connection represents the information needed to connect to Vault. This operator uses the standard Vault environment variables to connect to Vault. If you need to override those settings and for example connect to a different Vault instance, you can do with this section of the CR.
31+
// +kubebuilder:validation:Optional
32+
Connection *vaultutils.VaultConnection `json:"connection,omitempty"`
33+
34+
// Authentication is the kube auth configuraiton to be used to execute this request
35+
// +kubebuilder:validation:Required
36+
Authentication vaultutils.KubeAuthConfiguration `json:"authentication,omitempty"`
37+
38+
// Path at which to make the configuration.
39+
// The final path in Vault will be {[spec.authentication.namespace]}/auth/{spec.path}/groups/{metadata.name}.
40+
// The authentication role must have the following capabilities = [ "create", "read", "update", "delete"] on that path.
41+
// +kubebuilder:validation:Required
42+
Path vaultutils.Path `json:"path,omitempty"`
43+
44+
AzureSERole `json:",inline"`
45+
46+
// The name of the object created in Vault. If this is specified it takes precedence over {metatada.name}
47+
// +kubebuilder:validation:Optional
48+
// +kubebuilder:validation:Pattern:=`[a-z0-9]([-a-z0-9]*[a-z0-9])?`
49+
Name string `json:"name,omitempty"`
50+
}
51+
52+
// AzureSecretEngineRoleStatus defines the observed state of AzureSecretEngineRole
53+
type AzureSecretEngineRoleStatus struct {
54+
// +patchMergeKey=type
55+
// +patchStrategy=merge
56+
// +listType=map
57+
// +listMapKey=type
58+
Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
59+
}
60+
61+
//+kubebuilder:object:root=true
62+
//+kubebuilder:subresource:status
63+
64+
// AzureSecretEngineRole is the Schema for the azuresecretengineroles API
65+
type AzureSecretEngineRole struct {
66+
metav1.TypeMeta `json:",inline"`
67+
metav1.ObjectMeta `json:"metadata,omitempty"`
68+
69+
Spec AzureSecretEngineRoleSpec `json:"spec,omitempty"`
70+
Status AzureSecretEngineRoleStatus `json:"status,omitempty"`
71+
}
72+
73+
//+kubebuilder:object:root=true
74+
75+
// AzureSecretEngineRoleList contains a list of AzureSecretEngineRole
76+
type AzureSecretEngineRoleList struct {
77+
metav1.TypeMeta `json:",inline"`
78+
metav1.ListMeta `json:"metadata,omitempty"`
79+
Items []AzureSecretEngineRole `json:"items"`
80+
}
81+
82+
type AzureSERole struct {
83+
// List of Azure roles to be assigned to the generated service principal.
84+
// The array must be in JSON format, properly escaped as a string. See roles docs for details on role definition.
85+
// +kubebuilder:validation:Optional
86+
// +kubebuilder:default=""
87+
AzureRoles string `json:"azureRoles,omitempty"`
88+
89+
// List of Azure groups that the generated service principal will be assigned to.
90+
// The array must be in JSON format, properly escaped as a string. See groups docs for more details.
91+
// +kubebuilder:validation:Optional
92+
// +kubebuilder:default=""
93+
AzureGroups string `json:"azureGroups,omitempty"`
94+
95+
// Application Object ID for an existing service principal that will be used instead of creating dynamic service principals.
96+
// If present, azure_roles will be ignored. See roles docs for details on role definition.
97+
// +kubebuilder:validation:Optional
98+
// +kubebuilder:default=""
99+
ApplicationObjectID string `json:"applicationObjectID,omitempty"`
100+
101+
// If set to true, persists the created service principal and application for the lifetime of the role.
102+
// Useful for when the Service Principal needs to maintain ownership of objects it creates
103+
// +kubebuilder:validation:Optional
104+
// +kubebuilder:default=false
105+
PersistApp bool `json:"persistApp"`
106+
107+
// Specifies the default TTL for service principals generated using this role.
108+
// Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
109+
// +kubebuilder:validation:Optional
110+
// +kubebuilder:default=""
111+
TTL string `json:"TTL,omitempty"`
112+
113+
// Specifies the maximum TTL for service principals generated using this role.
114+
// Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
115+
// +kubebuilder:validation:Optional
116+
// +kubebuilder:default=""
117+
MaxTTL string `json:"maxTTL,omitempty"`
118+
119+
// Specifies whether to permanently delete Applications and Service Principals that are dynamically created by Vault.
120+
// If application_object_id is present, permanently_delete must be false.
121+
// +kubebuilder:validation:Optional
122+
// +kubebuilder:default=""
123+
PermanentlyDelete string `json:"permanentlyDelete,omitempty"`
124+
125+
// Specifies the security principal types that are allowed to sign in to the application.
126+
// Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount.
127+
// +kubebuilder:validation:Optional
128+
// +kubebuilder:default=""
129+
SignInAudience string `json:"signInAudience,omitempty"`
130+
131+
// A comma-separated string of Azure tags to attach to an application.
132+
// +kubebuilder:validation:Optional
133+
// +kubebuilder:default=""
134+
Tags string `json:"tags,omitempty"`
135+
}
136+
137+
var _ vaultutils.VaultObject = &AzureSecretEngineRole{}
138+
var _ vaultutils.ConditionsAware = &AzureSecretEngineRole{}
139+
140+
func init() {
141+
SchemeBuilder.Register(&AzureSecretEngineRole{}, &AzureSecretEngineRoleList{})
142+
}
143+
144+
func (r *AzureSecretEngineRole) GetKubeAuthConfiguration() *vaultutils.KubeAuthConfiguration {
145+
return &r.Spec.Authentication
146+
}
147+
148+
func (d *AzureSecretEngineRole) GetPath() string {
149+
if d.Spec.Name != "" {
150+
return vaultutils.CleansePath(string(d.Spec.Path) + "/" + "roles" + "/" + d.Spec.Name)
151+
}
152+
return vaultutils.CleansePath(string(d.Spec.Path) + "/" + "roles" + "/" + d.Name)
153+
}
154+
155+
func (d *AzureSecretEngineRole) GetPayload() map[string]interface{} {
156+
return d.Spec.toMap()
157+
}
158+
159+
func (d *AzureSecretEngineRole) IsDeletable() bool {
160+
return true
161+
}
162+
163+
func (d *AzureSecretEngineRole) GetVaultConnection() *vaultutils.VaultConnection {
164+
return d.Spec.Connection
165+
}
166+
167+
func (d *AzureSecretEngineRole) IsEquivalentToDesiredState(payload map[string]interface{}) bool {
168+
desiredState := d.Spec.AzureSERole.toMap()
169+
return reflect.DeepEqual(desiredState, payload)
170+
}
171+
172+
func (d *AzureSecretEngineRole) IsInitialized() bool {
173+
return true
174+
}
175+
176+
func (r *AzureSecretEngineRole) IsValid() (bool, error) {
177+
return true, nil
178+
}
179+
180+
func (d *AzureSecretEngineRole) PrepareInternalValues(context context.Context, object client.Object) error {
181+
return nil
182+
}
183+
184+
func (d *AzureSecretEngineRole) PrepareTLSConfig(context context.Context, object client.Object) error {
185+
return nil
186+
}
187+
188+
func (r *AzureSecretEngineRole) GetConditions() []metav1.Condition {
189+
return r.Status.Conditions
190+
}
191+
192+
func (r *AzureSecretEngineRole) SetConditions(conditions []metav1.Condition) {
193+
r.Status.Conditions = conditions
194+
}
195+
196+
func (i *AzureSERole) toMap() map[string]interface{} {
197+
payload := map[string]interface{}{}
198+
payload["azure_roles"] = i.AzureRoles
199+
payload["azure_groups"] = i.AzureGroups
200+
payload["application_object_id"] = i.ApplicationObjectID
201+
payload["persist_app"] = i.PersistApp
202+
payload["ttl"] = i.TTL
203+
payload["max_ttl"] = i.MaxTTL
204+
payload["permanently_delete"] = i.PermanentlyDelete
205+
payload["sign_in_audience"] = i.SignInAudience
206+
payload["tags"] = i.Tags
207+
208+
return payload
209+
}

‎api/v1alpha1/azuresecretenginerole_webhook.go‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
/*
2+
Copyright 2021.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package v1alpha1
18+
19+
import (
20+
"errors"
21+
22+
"k8s.io/apimachinery/pkg/runtime"
23+
ctrl "sigs.k8s.io/controller-runtime"
24+
logf "sigs.k8s.io/controller-runtime/pkg/log"
25+
"sigs.k8s.io/controller-runtime/pkg/webhook"
26+
"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
27+
)
28+
29+
// log is for logging in this package.
30+
var azuresecretenginerolelog = logf.Log.WithName("azuresecretenginerole-resource")
31+
32+
func (r *AzureSecretEngineRole) SetupWebhookWithManager(mgr ctrl.Manager) error {
33+
return ctrl.NewWebhookManagedBy(mgr).
34+
For(r).
35+
Complete()
36+
}
37+
38+
//+kubebuilder:webhook:path=/mutate-redhatcop-redhat-io-v1alpha1-azuresecretenginerole,mutating=true,failurePolicy=fail,sideEffects=None,groups=redhatcop.redhat.io,resources=azuresecretengineroles,verbs=create,versions=v1alpha1,name=mazuresecretenginerole.kb.io,admissionReviewVersions=v1
39+
40+
var _ webhook.Defaulter = &AzureSecretEngineRole{}
41+
42+
// Default implements webhook.Defaulter so a webhook will be registered for the type
43+
func (r *AzureSecretEngineRole) Default() {
44+
azuresecretenginerolelog.Info("default", "name", r.Name)
45+
}
46+
47+
//+kubebuilder:webhook:path=/validate-redhatcop-redhat-io-v1alpha1-azuresecretenginerole,mutating=false,failurePolicy=fail,sideEffects=None,groups=redhatcop.redhat.io,resources=azuresecretengineroles,verbs=update,versions=v1alpha1,name=vazuresecretenginerole.kb.io,admissionReviewVersions=v1
48+
49+
var _ webhook.Validator = &AzureSecretEngineRole{}
50+
51+
// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
52+
func (r *AzureSecretEngineRole) ValidateCreate() (admission.Warnings, error) {
53+
azuresecretenginerolelog.Info("validate create", "name", r.Name)
54+
55+
return nil, nil
56+
}
57+
58+
// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
59+
func (r *AzureSecretEngineRole) ValidateUpdate(old runtime.Object) (admission.Warnings, error) {
60+
azuresecretenginerolelog.Info("validate update", "name", r.Name)
61+
if r.Spec.Path != old.(*AzureSecretEngineRole).Spec.Path {
62+
return nil, errors.New("spec.path cannot be updated")
63+
}
64+
65+
return nil, nil
66+
}
67+
68+
// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
69+
func (r *AzureSecretEngineRole) ValidateDelete() (admission.Warnings, error) {
70+
azuresecretenginerolelog.Info("validate delete", "name", r.Name)
71+
72+
return nil, nil
73+
}

‎api/v1alpha1/webhook_suite_test.go‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -234,12 +234,19 @@ var _ = BeforeSuite(func() {
234234
err = (&AzureAuthEngineRole{}).SetupWebhookWithManager(mgr)
235235
Expect(err).NotTo(HaveOccurred())
236236

237+
err = (&AzureSecretEngineConfig{}).SetupWebhookWithManager(mgr)
238+
Expect(err).NotTo(HaveOccurred())
239+
240+
err = (&AzureSecretEngineRole{}).SetupWebhookWithManager(mgr)
241+
Expect(err).NotTo(HaveOccurred())
242+
237243
err = (&GCPAuthEngineConfig{}).SetupWebhookWithManager(mgr)
238244
Expect(err).NotTo(HaveOccurred())
239245

240246
err = (&GCPAuthEngineRole{}).SetupWebhookWithManager(mgr)
241247
Expect(err).NotTo(HaveOccurred())
242-
248+
249+
243250
//+kubebuilder:scaffold:webhook
244251

245252
go func() {

0 commit comments

Comments
 (0)